LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 07-14-2013, 06:31 PM   #1
tonj
Member
 
Registered: Sep 2008
Posts: 384

Rep: Reputation: 24
recover deleted directories


I have a usb drive that is a linux partition and I've lost several big directories on it, each one full of important files. I need a way to scan the drive and undelete the directories if that's possible. Bulk file recovery is no good in this case, I need the directory structures back as well. The drive is seperate to the OS and contains only saved data.
I tried photorec and scalpel some other programs but they all force you to copy unstructured data to another drive and I don't want that. What I want is undelete the files and directories in situ if they are still there. I don't care about loss of current visible files on the drive.
I have the drive plugged into a centos6 machine and I tried extundelete but that gave:
ERROR: The specified device does not have a journal file. This program only undeletes files from file systems with journals.extundelete: Operation not permitted when trying to load filesystem parameters
(grrrr.) This is puzzling because there are still visible files on the drive so I thought it must have a journal...I also tried debugfs and lsdel but it only found 1 inode at 1Mb (whatever that is).
is there any good program to scan and undelete these directories?
 
Old 07-14-2013, 07:09 PM   #2
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,117

Rep: Reputation: 330Reputation: 330Reputation: 330Reputation: 330
Quote:
Originally Posted by tonj View Post
I have a usb drive that is a linux partition and I've lost several big directories on it, each one full of important files.
How did you "lose" the directories? Through corruption of the directory structure? Or by legal, though unintentional or misguided manual deletion? What filesystem type is the USB drive? Since you tried "extundelete" I assume it's some flavor of ext. Is it ext, ext2, ext3 or ext4? Have you written anything to the drive after the problem occurred? Have you tried any "recovery in place" (which might have written to the drive)? Is there any directory structure still visible on the drive? You mentioned some files are still visible, but what about directories? Were these visible files there before the deletion occurred, or have they been added since?

Note: The above questions are not so much to recommend a specific recovery strategy, but more to gain additional information to see if a recovery is even possible.

Unless you have lots of files and lots of directories and no way to figure out which files go into which directories, it may be easier to recover the raw files using photorec or similar, then manually create a new directory structure and manually put each file in it's place. Obviously this would not be workable if you have hundreds of directories and thousands of files.
 
Old 07-14-2013, 07:12 PM   #3
ukiuki
Senior Member
 
Registered: May 2010
Location: Planet Earth
Distribution: Debian
Posts: 1,030

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
What kind of partition is that, ext3, ext4 ?
Have you tried magicrescue and testdisk? What about dd(be very careful with this one)?
Here some info about inodes: http://www.linfo.org/inode.html

Regards
 
Old 07-14-2013, 09:27 PM   #4
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Debian, Mint, OpenBSD
Posts: 11,352
Blog Entries: 12

Rep: Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731
Try photorec.

I've never needed it, but I've heard good reports on it. Be sure to read the instructions at the link above first.
 
Old 07-15-2013, 04:35 AM   #5
tonj
Member
 
Registered: Sep 2008
Posts: 384

Original Poster
Rep: Reputation: 24
thanks for the responses here. I had the usb drive plugged into a nas device (linksys NSLU2) and it had several directories on it. The backup I was doing over the network went wrong and was taking ages so I stopped the backup, unplugged the drive from the nas and plugged it into the machine I wanted to back up and I ran Clonezilla on it and did a backup onto the usb drive. The backup appeared to work perfectly. But when I plugged the usb drive back in to the nas device my original directories were all gone. All that was there was the backup I'd just done with clonezilla which is one directory with files in it.
The usb drive is /dev/sdb1 and is ext2 based on the following commands:

# file -sL /dev/sdb1
/dev/sdb1: Linux rev 1.0 ext2 filesystem data (mounted or unclean)

# fsck -N /dev/sdb1
fsck from util-linux-ng 2.17.2
[/sbin/fsck.ext2 (1) -- /dev/sdb1] fsck.ext2 /dev/sdb1

since discovering this loss of data I haven't written anything to the drive. Through the night I ran photorec on it but it just found 6.3Gb of useless stuff with no directory structures.
 
Old 07-15-2013, 10:24 PM   #6
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Debian, Mint, OpenBSD
Posts: 11,352
Blog Entries: 12

Rep: Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731
My understanding is that Photorec will not restore your directory structure or file names. It does give you a chance to examine the files it finds and determine what's worth keeping.

If you had nothing on that drive that you don't have a copy of elsewhere, it's probably not worth the effort. fsck it, reformat, and start over.

Last edited by frankbell; 07-15-2013 at 10:29 PM.
 
Old 07-16-2013, 12:09 AM   #7
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,117

Rep: Reputation: 330Reputation: 330Reputation: 330Reputation: 330
It sounds like for whatever reason, Clonezilla nuked everything previously existing on your thumbdrive. I have never used Clonezilla, so I don't know why it would have done that, or if it was something that could have been prevented with different options to Clonezilla.

But bottom line: I think since Clonezilla wrote to the thumbdrive, you're in for a helluva time trying to pull the old files off of it now. Photorec might be able to get some stuff off, but as has already been mentioned you would have to manually rename each recovered file and manually recreate the missing directory structure. Not fun. And chances of 100% success are basically nil. Chances of much success at all are pretty low.

If I understood you correctly, your initial attempt was to do a backup to the thumbdrive while it was plugged into your NAS device. When that failed (took too long), you tried doing the backup a different way (or maybe that second thing was an entirely different backup). But, if these were backups, don't you still have the original files you were backing up? Just start over from scratch then. But I have a sneaking suspicion that the original files must no longer be available, otherwise why would you be asking about recovery techniques here? If you no longer have the original files, I'm not sure I have any suggestions for you at this point.

In the future, I would recommend alternating backups. Never overwrite your previous backup with a newer backup. I use A and B directory structures for my backups. Which directory gets written to is controlled by which directory has been writen more recently than the other - the oldest of the two direcories is the one that gets the current backup. So if any given backup craps out, I still have the other backup left intact. If a backup croaks and craps out "A", don't turn around and try it again on "B". That could spell disaster. Investigate what went wrong, and when you re-try the backup, do it to a temporary C directory. Even better would be to use A and B drives (rather than directories), but I haven't gone to that extra trouble (and expense) myself.
 
Old 07-16-2013, 07:03 AM   #8
tonj
Member
 
Registered: Sep 2008
Posts: 384

Original Poster
Rep: Reputation: 24
ironically the usb drive in question contained backup images of my various machines before they got nuked by clonezilla. Photorec found thousands of files but they were just junk. I've given up on this now, formatted the drive and I'll start again. It means backing up all the machines again but that's not the end of the world. This is the second time I've lost backups so the lesson I've learnt from this is to backup each machine twice, both on different drives which I'll do from now on.

Last edited by tonj; 07-16-2013 at 07:09 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Recover deleted folder makowka Linux - General 2 11-23-2012 09:05 AM
[SOLVED] Help, I deleted a file. How do I recover it? coolgreen1 Linux - General 10 11-22-2010 04:39 PM
I have deleted rc.d from /etc. How can I recover it? rupeshukla Linux - Newbie 5 07-01-2008 05:21 AM
How to recover deleted Files sundar_reddy Linux - Software 2 10-25-2007 07:00 PM
how to recover deleted files sibtay Linux - Software 13 01-22-2005 09:09 PM


All times are GMT -5. The time now is 08:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration